Debian DSA-1730-1 : proftpd-dfsg - SQL injection vulnerabilites

The security update for proftpd-dfsg in DSA-1727-1 caused a regression with the postgresql backend. This update corrects the flaw. Also it was discovered that the oldstable distribution etch is not affected by the security issues. For reference the original advisory follows. Two SQL injection...

[SECURITY] [DSA 1730-1] New proftpd-dfsg packages fix SQL injection vulnerabilites

------------------------------------------------------------------------ Debian Security Advisory DSA-1730-1 [email protected] http://www.debian.org/security/ Steffen Joeris March 02, 2009 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1730-1] New proftpd-dfsg packages fix SQL injection vulnerabilites

------------------------------------------------------------------------ Debian Security Advisory DSA-1730-1 [email protected] http://www.debian.org/security/ Steffen Joeris March 02, 2009 http://www.debian.org/security/faq -...

DSA-1730-1 proftpd-dfsg - SQL injection vulnerabilites

Bulletin has no description...

Update Protection against ProFTPD Server Username Handling SQL Injection

A vulnerability was reported in the ProFTPD server, a File Transfer Protocol FTP server mainly used in Linux distributions. The flaw is due to improper validation of a user-supplied username string before being used in an SQL query. A remote unauthenticated attacker can trigger this vulnerability...

Fedora Update for proftpd FEDORA-2007-2613

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for proftpd FEDORA-2007-2613

Check for the Version of proftpd OpenVAS Vulnerability Test Fedora Update for proftpd FEDORA-2007-2613 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

[SECURITY] [DSA 1727-1] New proftpd-dfsg packages fix SQL injection vulnerabilites

-------------------------------------------------------------------------- Debian Security Advisory DSA 1727-1 [email protected] http://www.debian.org/security/ Steffen Joeris February 26th, 2009 http://www.debian.org/security/faq -...

Debian DSA-1727-1 : proftpd-dfsg - SQL injection vulnerabilites

Two SQL injection vulnerabilities have been found in proftpd, a virtual-hosting FTP daemon. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2009-0542 Shino discovered that proftpd is prone to a SQL injection vulnerability via the use of certain character...

DSA-1727-1 - SQL injection vulnerabilites

Bulletin has no description...

ProFTPD 1.3.1 - 1.3.2rc2 SQLi Vulnerability

ProFTPD is prone to remote SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:proftpd:proftpd";...

ProFTPD Detection (Linux/Unix SSH Login)

SSH login-based detection of ProFTPD Server. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ProFTPD Username Variable Substitution SQL Injection

The remote host is using ProFTPD, a free FTP server for Unix and Linux. The variable substitution feature in the version of ProFTPD running on the remote host can be abused to conduct a SQL injection attack. For example, a remote attacker can bypass authentication using a specially crafted userna...

ProFTPD mod_sql用户名SQL注入漏洞

BUGTRAQ ID: 33722 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的SQL认证模块没有正确地处理百分号字符（%）。在modsql查询中，可使用百分号表示变量。当modsql模块查找到百分号时，就会试图用变量替换，这就改变了基本查询的用户名。例如，对于用户名tj%string.com，由于会使用FTP响应状态替换百分号，但不存在状态值，因此会使用默认的“-”字符串，这个用户名最终变为tj-tring.com。 ProFTPD Project ProFTPD 1.3.2 ProFTPD Project ProFTPD 1.3.1 厂商补丁： ProFTPD...

ProFTPD Username Variable Substitution SQL Injection

Binary data 4930.prm...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

Sql injection

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

DSquare Exploit Pack: D2SEC_PROFTPD_MODSQL

Name| d2secproftpdmodsql ---|--- CVE| CVE-2009-0542 Exploit Pack| D2ExploitPack Description| d2secproftpdmodsql Notes|...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

Sql injection

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...